Reply from someone you wrote to is dropped as a stranger's, with no notice #85

New issue

Open

opened 2026-11-04 20:24:35 +00:00 by asxpi · 0 comments

asxpi commented

2026-11-04 20:24:35 +00:00

Member

Someone you have written to is still a stranger: their reply is dropped with no trace, and stays lost after allowing strangers.

What happened

Found in an interop hand test (0.8.0-rc2 on libtacky v1.2.0-rc2, Prosody 13.0.7, Gajim 2.6.0 as the peer), with "messages from strangers" off, the default:

Alice (AnotherIM) writes to Bob, who is not in her contacts. Bob gets it.
Bob answers "tset", then corrects it to "test".
Alice sees nothing: no message, no request, no notice.
Alice turns on messages from strangers. Bob's next messages arrive, but "tset"/"test" never show up. Reopening the chat (archive catch-up) does not bring them back either.

AnotherIM's XML log shows both stanzas arriving and being dropped (times UTC, 2026-11-04):

20:10:17 out  to bob@prosody.asxp.io  (Alice's first message, OMEMO)
20:10:39 in   from bob@prosody.asxp.io/gajim…  <body>tset</body>
20:10:53 in   from bob@prosody.asxp.io/gajim…  <body>test</body><replace … id='a9518209-…'/>

Full logs of the client, Gajim and the server: another-im/interop runs/20261104-200806-XEP-0308-gajim-prosody.

Expected

A chat I started is not with a stranger. If I sent a message to a JID, their messages in that 1:1 chat should be accepted even without a roster item. Today libtacky's rule (messages_from_strangers, HANDBOOK "Installation-wide settings") admits roster items at to/from/both, transport users, servers and components, rooms and own copies, but not someone the account has written to.
A dropped message is visible. libtacky tells message <Blocked> with reason stranger, but nothing in ui/src handles that event (only the generated type), so the user cannot know a reply was blocked or let the sender in.
Optionally: allowing strangers (or the sender) afterwards brings back what was blocked, e.g. from MAM, since the catch-up applies the same rule.

Where

The rule: libtacky (message StrangerBlocked, roster transportUser).
The missing notice: the UI (no listener for message.Blocked).

Someone you have written to is still a stranger: their reply is dropped with no trace, and stays lost after allowing strangers. ## What happened Found in an interop hand test (0.8.0-rc2 on libtacky v1.2.0-rc2, Prosody 13.0.7, Gajim 2.6.0 as the peer), with "messages from strangers" off, the default: 1. Alice (AnotherIM) writes to Bob, who is not in her contacts. Bob gets it. 2. Bob answers "tset", then corrects it to "test". 3. Alice sees nothing: no message, no request, no notice. 4. Alice turns on messages from strangers. Bob's next messages arrive, but "tset"/"test" never show up. Reopening the chat (archive catch-up) does not bring them back either. AnotherIM's XML log shows both stanzas arriving and being dropped (times UTC, 2026-11-04): ``` 20:10:17 out to bob@prosody.asxp.io (Alice's first message, OMEMO) 20:10:39 in from bob@prosody.asxp.io/gajim… <body>tset</body> 20:10:53 in from bob@prosody.asxp.io/gajim… <body>test</body><replace … id='a9518209-…'/> ``` Full logs of the client, Gajim and the server: [another-im/interop runs/20261104-200806-XEP-0308-gajim-prosody](https://dev.another.im/another-im/interop/src/branch/main/runs/20261104-200806-XEP-0308-gajim-prosody). ## Expected - **A chat I started is not with a stranger.** If I sent a message to a JID, their messages in that 1:1 chat should be accepted even without a roster item. Today libtacky's rule (`messages_from_strangers`, HANDBOOK "Installation-wide settings") admits roster items at to/from/both, transport users, servers and components, rooms and own copies, but not someone the account has written to. - **A dropped message is visible.** libtacky tells `message <Blocked>` with reason `stranger`, but nothing in `ui/src` handles that event (only the generated type), so the user cannot know a reply was blocked or let the sender in. - Optionally: allowing strangers (or the sender) afterwards brings back what was blocked, e.g. from MAM, since the catch-up applies the same rule. ## Where - The rule: libtacky (`message StrangerBlocked`, `roster transportUser`). - The missing notice: the UI (no listener for `message.Blocked`).